Bitcoin Core maintainers have changed the project’s vulnerability disclosure policy to accelerate fixes for security problems that an artificial intelligence model could rediscover with a simple prompt.
The change ends the expectation that these bugs should remain confidential for months while users gradually upgrade. Instead, developers can classify a vulnerability as easy to discover during their initial review, backport the fix to every supported Core version and publish it in a point release as soon as possible, together with a security advisory containing relevant details.
According to CoinDesk, the policy was merged on Thursday after a sharp increase in security reports assisted by AI tools. Bitcoin Core is the software used by most of the bitcoin network. It is run by nodes, the computers that validate and relay bitcoin transactions, so weaknesses in the software can have consequences beyond an individual application.
Why the disclosure timetable changed
Bitcoin Core’s previous system linked disclosure timing to the assessed severity of a vulnerability. Lower-severity issues were disclosed two weeks after the next major release became available. Medium- and high-severity flaws generally remained under embargo until two weeks after the last affected release reached the end of its life.
That approach was intended to limit the information available to attackers. Developers could quietly prepare and distribute a fix, while delaying technical details until operators had more time to install an updated version. The underlying assumption was that identifying a weakness required enough specialist knowledge that an embargo would meaningfully protect users.
Maintainers now say that assumption does not hold for some classes of bugs. Antoine Poinsot, a Chaincode Labs developer who proposed the change, said the project had seen more reports involving vulnerabilities that could be easily rediscovered. In his explanation, large language models have lowered the difficulty of finding certain issues and of recognizing fixes that had previously been difficult to identify.
Under the new policy, the practical test is whether a flaw can be found with a simple prompt to an AI model. For such vulnerabilities, the maintainers concluded that keeping the issue secret can delay the release of protection without providing much additional security.
Faster patches, less testing time
The new process also changes the balance between speed and software testing. Poinsot warned that fixes released under the new approach will have less “bake time” before they reach users. In other words, developers may have less opportunity to test a patch in the field before it is distributed.
That trade-off was not universally accepted among Bitcoin Core contributors. Antoine Riard, a longtime bitcoin security researcher, argued that the project should retain the option of releasing a fix without immediately publishing an advisory and should decide how much information to provide on a case-by-case basis.
Poinsot rejected that proposal. His position was that alerting users to a security problem without explaining it could create unnecessary risk, including rushed upgrades by people who were not affected by the issue. The adopted policy therefore couples the rapid patch with a security advisory that provides details.
No vulnerability had been formally classified under the new rule when the policy was reported. Its significance lies in the project’s response to a changing discovery environment: if an AI system can reproduce a secret easily, a long embargo may no longer keep that secret from attackers.
AI-assisted reports raise the stakes
The policy follows a summer of intense AI-assisted security testing across bitcoin-related software. A volunteer group of 16 developers called the Bitcoin Red Team used AI models to review 390 bitcoin projects in roughly one day in late July. The group recorded 4,962 potential findings, including 85 it classified as critical.
Some reports quickly demonstrated the danger of genuine weaknesses. A BTCPay Server flaw disclosed privately by the group was exploited on live merchant servers within days. The attacks drained Lightning nodes used by merchants to accept small bitcoin payments. Core Lightning, one of the major Lightning implementations, instructed operators to disconnect after reports generated with AI assistance were confirmed as real.
The source material also describes a separate, larger loss involving a vulnerability that did not require AI to find. A Coldcard hardware-wallet firmware flaw that had been dormant since 2021 allowed attackers to drain 594 BTC in 25 minutes on July 30. Losses approached $114 million across four sweeps. When Coldcard released a fix, it said AI had helped identify additional bugs during the process.
These incidents provide the backdrop for Bitcoin Core’s revised policy. The project must now decide when withholding technical information offers meaningful protection and when it simply leaves users exposed while a patch is delayed.
Current crypto market picture
Moneyiar market data recorded at the stated times shows Bitcoin at $80,605.61 at 07:59 on October 24, 2026, down 1.04% over 24 hours and 1.23% over seven days.
- Polygon’s former MATIC token had no price listed in the supplied data.
- Polygon (prev. MATIC), listed under the symbol POL, was at $0.0897674126 at 07:58, down 2.29% in 24 hours and 4.26% over seven days.
- Monad, under the symbol MON, stood at $0.0211562723 at 07:59, down 2.53% over 24 hours and 6.65% over seven days.
These figures are Moneyiar market data and are separate from the Bitcoin Core security-policy announcement.
